UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF GEORGIA 
ATLANTA DIVISION 


SECURITIES AND EXCHANGE 
COMMISSION, 

Plaintiff, 

y. 

SUDHAKAR REDDY BONTHU, 

Defendant. 


Case No. 


JURY TRIAL 
DEMANDED 


COMPLAINT 


Plaintiff, Securities and Exchange Commission (the “Commission”), files its 
complaint and alleges that: 

SUMMARY 

1. Defendant Sudhakar Reddy Bonthu (“Bonthu”) committed securities fraud 
by engaging in illegal insider trading in the securities of Equifax Inc. (“Equifax” or 
“the company”). Bonthu was an Equifax employee from September 2003 until 
March 2018. 

2. In late August 2017, after being entrusted by his employer with material 


nonpublic information about a massive cyber-intrusion and data breach purportedly 



suffered by an unnamed client of the company, Bonthu deduced that Equifax was 
itself the victim of the breach. Bonthu then traded against the company by 
purchasing risky put option contracts in Equifax common stock. 

3. On September 8, 2017, the day after Equifax publicly announced that it had 
suffered a massive breach, Bonthu sold all of his Equifax put options for total net 
proceeds of more than $75,000. 

4. By the conduct detailed in this Complaint, Bonthu violated Section 10(b) of 
the Securities Exchange Act of 1934 (“Exchange Act”) [15 U.S.C. § 78j(b)] and 
Rule 10b-5 [17 C.F.R. § 240.10b-5] thereunder. Unless enjoined, Bonthu is likely 
to commit such violations again in the future. 

5. The Commission seeks a judgment from the Court: (a) enjoining Bonthu 
from engaging in future violations of the antifraud provisions of the federal 
securities laws; and (b) ordering Bonthu to disgorge an amount equal to his ill- 
gotten gains resulting from the actions described herein, with prejudgment interest. 

JURISDICTION AND VENUE 

6. The Commission brings this action pursuant to Section 21(d) of the 
Exchange Act [15 U.S.C. § 78u(d)]. 

7. The Court has jurisdiction over this action pursuant to Sections 21(d), 21(e), 
21A and 27 of the Exchange Act [15 U.S.C. §§ 78u(d), 78u(e), 78u-l, and 78aa], 
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8. Bonthu, directly or indirectly, used the means or instruments of interstate 
commerce, the mails, or the facilities of a national securities exchange in 
connection with the acts described herein. 

9. Venue is proper under Section 27 of the Exchange Act [15 U.S.C. § 78aa] 
and 28 U.S.C. § 1391 because a substantial part of the events or omissions giving 
rise to the claims made herein occurred in the Northern District of Georgia. In 
addition, Bonthu currently resides in the Northern District of Georgia. 

DEFENDANT 

10. Sudhakar Reddy Bonthu, age 44, is a resident of Gumming, Georgia. 
Bonthu is a citizen of India and a permanent resident of the United States. He was 
an employee of Equifax from September 2003 until March 2018. Beginning in 
September 2013, he was a Production Development Manager of Software 
Engineering in Equifax’s Global Consumer Solutions (“GCS”) business unit. On 
March 12, 2018, his employment was terminated by Equifax. Bonthu is currently 
unemployed. 

RELEVANT ENTITY 

11. Equifax Inc., an information solutions and human resources company, is a 
Georgia corporation headquartered in Atlanta, Georgia. Equifax’s common stock 
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trades on the New York Stock Exchange under the symbol “EFX.” Equifax is one 
of three major consumer credit bureaus. 

STATEMENT OF FACTS 
I. The Equifax Cybersecurity Breach 

12. On July 29, 2017, Equifax’s security department observed suspicious 
network traffic within an internal system. Over the next several weeks, it was 
determined that Equifax had been subject to cyber-intrusions that resulted in a 
breach of Equifax’s information technology (“IT”) systems. 

13. A crisis action team consisting of Equifax security, IT, and legal personnel 
was formed and began working to analyze forensic data and determine the scope of 
the intrusion. The analysis suggested it was likely that sensitive data, including 
personally identifiable information (“PH”) for millions of consumers, had been 
stolen. 

14. Equifax established a notification and remediation plan for the millions of 
consumers affected by the breach. The company designated this effort as “Project 
Sparta.” 

15. Although the crisis action team members were aware that Equifax had been 
breached, the company made attempts to keep that information confidential from 
others. To limit the number of people who knew that Equifax itself had been 
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breached, the Equifax employees who were part of Project Sparta were told that 
they were working for an unnamed potential client that had experienced a large 
data breach. 

16. Project Sparta was handled largely through the company’s GCS unit, which 
developed and sold various personal security and identity theft defense products 
and services to clients. 

II. Bonthu is Entrusted with Information about thf Breach 

17. On August 25, 2017, Bonthu, a software product development manager 
working in GCS, was assigned to work on a “fast-breaking opportunity” for an 
unnamed potential client as a part of Project Sparta. 

18. Bonthu was told that the project was a high priority for the unnamed 
company and had a short deadline because the client intended to “go live” on 
September 6, 2017, with the breach remediation applications designed by Equifax. 

19. Bonthu was tasked with primary responsibility for developing an online user 
interface into which consumers could input information to determine whether they 
had been impacted by the breach. Bonthu was also responsible for creating an 
algorithm that would schedule consumers to return to Equifax’s website to register 
for identity protection tools. 
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20. Between August 25 and August 31, 2017, in connection with his work on 
Project Sparta, Bonthu received emails and participated in conversations that 
informed him that the breach impacted at least 100 million consumers - the largest 
breach opportunity Equifax ever had handled. 

21. In the course of his work, Bonthu also used test datasets that contained the 
same types of PII that had been impacted by the breach, including first and last 
names, addresses, phone numbers, dates of birth, and social security numbers. 

22. On August 31, 2017, Bonthu was copied on an email that attached a test 

dataset file that was named “EFXDatabreach.postmancollection.” 

III. Bonthu Concludes That Equifax was the Real Victim of the 
Breach 

23. By no later than August 31,2017, based on material nonpublic information 
entrusted to him by his employer, Equifax, Bonthu had concluded that Equifax 
itself was the victim of a major cybersecurity breach, despite the statements made 
as part of Project Sparta asserting that it was a business opportunity for an 
unnamed client. 

24. Bonthu owed a duty of trust and confidence to Equifax and its shareholders 
not to trade on the basis of material nonpublic information that he learned through 
his employment with Equifax, and was aware of his duty. 
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25. Bonthu knew or was reckless in not knowing that the information that 
Equifax was the victim of a major cybersecurity breach was material. 

26. Bonthu knew or was reckless in not knowing that the information that 
Equifax was the victim of a major cybersecurity breach was nonpublic. 

IV. Bonthu’ s Trading in Equifax Securities 

27. On September 1, 2017, Bonthu accessed his family’s brokerage accounts on 
their broker’s website. 

28. Bonthu had access to numerous family brokerage accounts, several of which 
were held in his own name and had cash available for new transactions. 

29. From the available accounts, however, Bonthu chose an account held solely 
in his wife’s name. 

30. In his wife’s account, Bonthu purchased eighty-six out-of-the-money put 
option contracts for shares of Equifax common stock with an expiration date of 
September 15, 2017, and a strike price of $130 per share. Bonthu made this 
purchase despite the fact that Equifax’s policies expressly prohibit any trading in 
derivative securities, including put and call options. 

31. By purchasing out-of-the-money put options, Bonthu could make money 
only if the market price of Equifax stock were to drop below the put option strike 
price before the contract expired approximately two weeks later, on September 15. 
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If the market price did not so drop, the put options would expire and his investment 
would be worthless. 

32. The strike price of $ 130 per share was more than $ 10 below the price at 
which Equifax common stock traded on that day. 

33. The total price of the Equifax option contracts purchased by Bonthu on 
September 1 was $2,166.11. 

34. Bonthu had never previously traded in Equifax options. 

V. Equifax Tells the Public about the Breach, and Bonthu Sells his 
Put Options 

35. After the close of the market on September 7, 2017, Equifax issued a press 
release and filed a Form 8-K with the Commission, announcing the cybersecurity 
breach and revealing that it potentially impacted approximately 143 million 
consumers in the United States. 

36. The breach was one of the leading news stories over the next several days 
and was described as “one of the worst [data breaches] ever, by its reach and by the 
kind of information exposed to the public.” 

37. On September 8, the price of Equifax common stock closed at $123.23, a 
drop of $19.49 (nearly 14%) per share from the prior day’s closing price of 
$142.72. Trading volume that day also increased dramatically to nearly seventeen 
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million shares, more than a thirty-fold increase from the previous day’s volume of 
approximately 518,000 shares. 

38. Also on the morning of September 8, and despite Equifax’s policies 
expressly forbidding transactions in derivative securities, Bonthu sold all of his 
Equifax put option contracts. As a result of the precipitous drop in Equifax’s share 
price, Bonthu turned his initial investment of $2,166.11 into $77,333.79 in only six 
days. In sum, Bonthu’s ill-gotten gains from his trading in Equifax options totaled 
$75,167.68, a return of more than 3,500% on his initial investment. 

39. Bonthu’s securities transactions were made on the basis of material 
nonpublic information and breached the duty of trust and confidence that he owed 
to Equifax and its shareholders. Bonthu knew or was reckless in not knowing that 
the information that Equifax itself was the victim of a major cybersecurity breach 
was material and nonpublic, and Bonthu used that information when making these 
securities transactions. 

40. Bonthu’s trading on the basis of material nonpublic information entrusted to 
him by Equifax was deceptive and fraudulent. 


9 



VI. Equifax Terminates Bonthu’s Employment 


41. On March 12, 2018, following Bonthu’s refusal to cooperate with an internal 

investigation into whether he had violated the company’s insider trading policy, 

Bonthu’s employment at Equifax was terminated. 

COUNT I - INSIDER TRADING IN CONNECTION 
WITH THE PURCHASE OR SALE OF SECURITIES 

Violations of Section 10(b) of the Exchange Act and Rule 10b-5 Thereunder 
[15 U.S.C. § 78i(b); 17 C.F.R. § 240.10b-5l 

42. The Commission realleges and reincorporates paragraphs 1 through 41 as if 
fully set forth herein. 

43. Bonthu, with scienter, by use of the means or instrumentalities of interstate 
commerce or of the mails, in connection with the purchase or sale of securities: (a) 
employed devices, schemes, or artifices to defraud; (b) made untrue statements of 
material fact or omissions to state material facts necessary in order to make the 
statements made, in light of the circumstances under which they were made, not 
misleading; and/or (c) engaged in acts, practices or courses of business which 
operated or would operate as a fraud or deceit. 

44. By reason of the actions alleged herein, Bonthu violated Section 10(b) of the 
Exchange Act [15 U.S.C. § 78j(b)] and Rule 10b-5 thereunder [17 C.F.R. 

§ 240.10b-5], 
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PRAYER FOR RELIEF 


WHEREFORE, the Commission respectfully requests that the Court enter a 
judgment: 

(i) finding that Bonthu violated the antifraud provisions of the federal 
securities laws as alleged herein; 

(ii) permanently enjoining Bonthu from violating Section 10(b) of the 
Exchange Act [15 U.S.C. § 78j(b)] and Rule 10b-5 thereunder [17 C.F.R. 

§ 240.10b-5]; 

(iii) ordering Bonthu to disgorge an amount equal to his ill-gotten gains 
resulting from the actions alleged herein and to pay prejudgment interest thereon; 
and 

(iv) granting such other relief as this Court may deem just and proper. 

DEMAND FOR JURY TRIAL 
Pursuant to Rule 38 of the Federal Rules of Civil Procedure, the 
Commission demands trial by jury in this action of all issues so triable. 

Dated this 28th day of June, 2018. 


11 



Respectfully submitted, 


/s/ M. Graham Loomis 


M. Graham Loomis 
Regional Trial Counsel 
Georgia Bar No. 457868 
Tel: (404) 842-7622 
Email: loomism@sec.gov 


W. Shawn Mumahan 
Senior Trial Counsel 
Georgia Bar No. 529940 
Tel: (404) 842-7669 
Email: murnahanw@sec.gov 


COUNSEL FOR PLAINTIFF 

Securities and Exchange Commission 

Atlanta Regional Office 

950 East Paces Ferry Road, N.E., Suite 900 

Atlanta, GA 30326-1382 

Tel (main): (404) 842-7600 

Fax:(703)813-9364 
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